DRF permissions in Django - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this permission check?

Given this Django REST Framework view permission setup, what will be the response status code if an unauthenticated user tries to access the view?

Django

from rest_framework.permissions import IsAuthenticated
from rest_framework.views import APIView
from rest_framework.response import Response

class MyView(APIView):
    permission_classes = [IsAuthenticated]

    def get(self, request):
        return Response({'message': 'Hello, authenticated user!'})

A 401 Unauthorized error

B 403 Forbidden error

C 500 Internal Server Error

D 200 OK with message 'Hello, authenticated user!'

💡 Hint

Think about what happens when a user is not logged in and the view requires authentication.

The IsAuthenticated permission class denies access to unauthenticated users by returning a 401 Unauthorized response. It does not return 403 Forbidden, which is for authenticated users without permission.

📝 Syntax

intermediate

Which option correctly applies multiple permissions in DRF?

You want to require that a user is authenticated and also has admin rights. Which of these permission_classes declarations is syntactically correct and will enforce both permissions?

A permission_classes = {IsAuthenticated, IsAdminUser}

B permission_classes = IsAuthenticated & IsAdminUser

C permission_classes = (IsAuthenticated, IsAdminUser)

D permission_classes = [IsAuthenticated, IsAdminUser]

💡 Hint

Remember that permission_classes expects a list or tuple of permission classes.

The permission_classes attribute must be a list or tuple of permission classes. Option D uses a list, which is correct. Option D uses bitwise AND which is invalid here. Option D is a tuple, so it is valid syntax but less common; however, DRF accepts tuples too. Option D uses a set which is not supported.

However, since option D is a tuple, it is syntactically valid but less common. To avoid ambiguity, the question expects the list form as the correct answer.

🔧 Debug

advanced

Why does this custom permission always deny access?

Examine this custom permission class. Why does it always deny access even for authenticated users?

Django

from rest_framework.permissions import BasePermission

class IsOwner(BasePermission):
    def has_object_permission(self, request, view, obj):
        if request.user == obj.owner:
            return True
        return False

A Because the class is missing an __init__ method

B Because request.user is never equal to obj.owner

C Because the method lacks a return False for the else case, so it returns None which is treated as False

D Because BasePermission requires has_permission method to be defined

💡 Hint

Think about what happens if the if condition is false and no return statement is given.

If the has_object_permission method does not explicitly return False when the condition fails, it returns None by default. DRF treats None as False, so permission is denied.

❓ state_output

advanced

What is the value of `permission_granted` after this check?

Given this code snippet, what will be the value of the variable permission_granted after calling the permission check?

Django

from rest_framework.permissions import IsAuthenticated

class DummyRequest:
    def __init__(self, user):
        self.user = user

class DummyUser:
    def __init__(self, is_authenticated):
        self.is_authenticated = is_authenticated

request = DummyRequest(DummyUser(is_authenticated=False))
permission = IsAuthenticated()
permission_granted = permission.has_permission(request, None)

A False

B True

C Raises AttributeError

D None

💡 Hint

Check how IsAuthenticated checks the user property.

The IsAuthenticated permission checks if request.user.is_authenticated is True. Here, it is False, so has_permission returns False.

🧠 Conceptual

expert

Which permission class combination enforces read-only for all but write access only for owners?

You want a view where anyone can read data, but only the owner of an object can update or delete it. Which combination of permission classes and methods achieves this behavior correctly?

A Use IsAdminUser for all requests and override has_permission to check ownership

B Use IsAuthenticatedOrReadOnly and a custom IsOwner permission in has_object_permission to allow writes only for owners

C Use AllowAny and check ownership in the serializer's save method

D Use IsAuthenticated and override get_queryset to filter only owner objects

💡 Hint

Think about how to allow everyone to read but restrict writes to owners.

IsAuthenticatedOrReadOnly allows anyone to read but requires authentication for write actions. Combining it with a custom IsOwner permission in has_object_permission ensures only owners can write. Other options either restrict too much or do not enforce permissions properly.

Practice

1. What is the main purpose of permissions in Django REST Framework (DRF)?

easy

A. To control who can access or modify API endpoints

B. To style the API responses

C. To speed up database queries

D. To manage user sessions

Solution

1. Step 1: Understand the role of permissions in DRF

   Permissions define rules about who can use or change API data.

2. Step 2: Compare options with permissions purpose

   Only controlling access matches the purpose of permissions.

3. Final Answer:

   To control who can access or modify API endpoints -> Option A

4. Quick Check:

   Permissions = Access control [OK]

Hint: Permissions control access, not styling or speed [OK]

Common Mistakes:

• Confusing permissions with styling or performance
• Thinking permissions manage sessions

2. Which of the following is the correct way to apply the built-in permission IsAuthenticated to a DRF view?

easy

A. permissions = IsAuthenticated()

B. permission_classes = [IsAuthenticated]

C. permission_classes = IsAuthenticated

D. permission_classes = (IsAuthenticated)

Solution

1. Step 1: Recall DRF permission syntax

   Permissions are set as a list or tuple in permission_classes.

2. Step 2: Check each option's syntax

   permission_classes = [IsAuthenticated] uses a list with the class name, which is correct. permissions = IsAuthenticated() uses wrong attribute name and instance. permission_classes = IsAuthenticated misses list brackets. permission_classes = (IsAuthenticated) uses parentheses but without a comma, so it's not a tuple.

3. Final Answer:

   permission_classes = [IsAuthenticated] -> Option B

4. Quick Check:

   Use list for permission_classes [OK]

Hint: Use a list of permission classes for permission_classes [OK]

Common Mistakes:

• Using instance instead of class in permission_classes
• Forgetting to wrap in list or tuple
• Using wrong attribute name

3. Given this DRF view snippet, what will happen if an anonymous user tries to access it?

from rest_framework.permissions import IsAuthenticated
from rest_framework.views import APIView

class MyView(APIView):
    permission_classes = [IsAuthenticated]

    def get(self, request):
        return Response({'message': 'Hello'})

medium

A. The user will receive a 401 Unauthorized response

B. The user will see the message 'Hello'

C. The user will receive a 403 Forbidden response

D. The server will raise a syntax error

Solution

1. Step 1: Understand IsAuthenticated permission behavior

   This permission denies access to anonymous users and returns 401 Unauthorized.

2. Step 2: Analyze the code behavior for anonymous user

   Since the user is not logged in, DRF returns 401, not 403 or success.

3. Final Answer:

   The user will receive a 401 Unauthorized response -> Option A

4. Quick Check:

   IsAuthenticated denies anonymous with 401 [OK]

Hint: IsAuthenticated returns 401 for anonymous users [OK]

Common Mistakes:

• Confusing 401 Unauthorized with 403 Forbidden
• Expecting anonymous users to see data
• Thinking code has syntax errors

4. Identify the error in this custom permission class:

from rest_framework.permissions import BasePermission

class IsOwner(BasePermission):
    def has_object_permission(self, request, view, obj):
        return obj.owner == request.user

# Usage in view
class MyView(APIView):
    permission_classes = [IsOwner()]

    def get(self, request, pk):
        obj = get_object(pk)
        self.check_object_permissions(request, obj)
        return Response({'id': obj.id})

medium

A. get_object method is undefined

B. has_object_permission method is missing a return statement

C. check_object_permissions is called incorrectly

D. Permission class should be passed as class, not instance

Solution

1. Step 1: Check how permission_classes should be set

   DRF expects permission classes, not instances, so use IsOwner without parentheses.

2. Step 2: Review other parts for errors

   has_object_permission returns correctly, check_object_permissions usage is correct, get_object assumed defined elsewhere.

3. Final Answer:

   Permission class should be passed as class, not instance -> Option D

4. Quick Check:

   Use class names, not instances in permission_classes [OK]

Hint: Use class names, not instances, in permission_classes [OK]

Common Mistakes:

• Passing permission instances instead of classes
• Assuming missing return in has_object_permission
• Confusing method calls with errors

5. You want to create a custom permission that allows access only if the user is authenticated and is the owner of the object. Which is the correct way to combine built-in and custom permissions in DRF?

hard

A. Set permission_classes = [IsAuthenticatedOrReadOnly, IsOwner] and override has_permission in IsOwner

B. Set permission_classes = [IsOwner] only and check authentication inside IsOwner

C. Set permission_classes = [IsAuthenticated, IsOwner] and implement has_object_permission in IsOwner

D. Set permission_classes = [IsAuthenticated()] and call IsOwner manually in the view

Solution

1. Step 1: Understand combining permissions in DRF

   DRF checks all permissions in the list; all must allow access.

2. Step 2: Check how to combine authentication and ownership

   Use IsAuthenticated to check login, and IsOwner to check object ownership via has_object_permission.

3. Step 3: Evaluate options

   Set permission_classes = [IsAuthenticated, IsOwner] and implement has_object_permission in IsOwner correctly combines both permissions. Set permission_classes = [IsOwner] only and check authentication inside IsOwner misses separate authentication check. Set permission_classes = [IsAuthenticatedOrReadOnly, IsOwner] and override has_permission in IsOwner mixes permission types incorrectly. Set permission_classes = [IsAuthenticated()] and call IsOwner manually in the view uses instance and manual calls, which is not standard.

4. Final Answer:

   Set permission_classes = [IsAuthenticated, IsOwner] and implement has_object_permission in IsOwner -> Option C

5. Quick Check:

   Combine permissions in list for layered checks [OK]

Hint: List all needed permissions in permission_classes [OK]

Common Mistakes:

• Skipping IsAuthenticated when ownership matters
• Using instances instead of classes
• Trying to call permissions manually